{{- if .Values.controller.enabled }}
{{- $tenantNs := include "bp-openclaw.tenantNamespace" . -}}
# ─── Per-user pod template (consumed by the controller) ──────────────────
# This ConfigMap holds the pod-spec template the controller renders per
# session. The controller reads it from /etc/openclaw/pod-template.yaml,
# substitutes ${USER_UUID} and ${SECRET_NAME}, and submits the resulting
# Pod to the K8s api-server.
#
# Substitution variables (filled by the controller at session-start):
#   ${USER_UUID}    — the SME user UUID (= JWT `sub` claim)
#   ${SECRET_NAME}  — `newapi-key-${USER_UUID}` (per ADR-0003 §3.3)
#
# Per [A] of #795: the runtime image reads ONLY two env vars
# (NEWAPI_BASE_URL + NEWAPI_KEY). It carries NO Keycloak code, NO key-
# management code, NO knowledge of the SME tenant model. Identity-blind
# by construction.
apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "bp-openclaw.podTemplateConfigMapName" . }}
  labels:
    {{- include "bp-openclaw.labels" . | nindent 4 }}
data:
  pod-template.yaml: |
    apiVersion: v1
    kind: Pod
    metadata:
      # The controller post-processes this name to be unique-per-session
      # (e.g. openclaw-user-${USER_UUID}-${SESSION_ID}).
      name: openclaw-user-${USER_UUID}
      namespace: {{ $tenantNs }}
      labels:
        app.kubernetes.io/name: {{ include "bp-openclaw.name" . }}
        app.kubernetes.io/component: per-user-pod
        catalyst.openova.io/blueprint: bp-openclaw
        catalyst.openova.io/openclaw-user: ${USER_UUID}
        # Ownership label — the controller's RBAC scope (Role rules 2/3
        # in controller-rbac.yaml) is enforced at the application layer
        # by selecting only pods that carry this label.
    spec:
      restartPolicy: Never
      automountServiceAccountToken: false
      securityContext:
        {{- toYaml .Values.perUserPod.securityContext | nindent 8 }}
      containers:
        - name: runtime
          image: "{{ .Values.perUserPod.image.repository }}:{{ .Values.perUserPod.image.tag }}"
          imagePullPolicy: {{ .Values.perUserPod.image.pullPolicy }}
          env:
            # NewAPI gateway — per-user Secret (ADR-0003 §3.3). The
            # runtime is identity-blind: it reads only these env vars.
            - name: NEWAPI_BASE_URL
              valueFrom:
                secretKeyRef:
                  name: ${SECRET_NAME}
                  key: base-url
            - name: NEWAPI_KEY
              valueFrom:
                secretKeyRef:
                  name: ${SECRET_NAME}
                  key: api-key
            # OpenAI-compatible aliases (any pre-built OpenAI SDK in the
            # runtime image picks these up without code changes).
            - name: OPENAI_API_BASE
              valueFrom:
                secretKeyRef:
                  name: ${SECRET_NAME}
                  key: base-url
            - name: OPENAI_API_KEY
              valueFrom:
                secretKeyRef:
                  name: ${SECRET_NAME}
                  key: api-key
            # Default model identifier sent by the runtime when the
            # client doesn't override. NewAPI uses the model name to
            # select a channel; for #915 DoD this is "qwen3.6" and C4
            # wires the BankDhofar channel routing.
            - name: LLM_DEFAULT_MODEL
              value: {{ include "bp-openclaw.llm.defaultModel" . | quote }}
            {{- range .Values.perUserPod.extraEnv }}
            - {{- toYaml . | nindent 14 }}
            {{- end }}
          resources:
            {{- toYaml .Values.perUserPod.resources | nindent 12 }}
          volumeMounts:
            - name: workspace
              mountPath: /workspace
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: workspace
          emptyDir:
            sizeLimit: 1Gi
        - name: tmp
          emptyDir:
            sizeLimit: 256Mi
{{- end }}
